{"id":39154,"date":"2020-05-09T07:34:11","date_gmt":"2020-05-09T14:34:11","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/premier-developer\/?p=39154"},"modified":"2022-09-09T09:41:12","modified_gmt":"2022-09-09T16:41:12","slug":"control-access-to-power-apps-and-power-automate-with-azure-ad-conditional-access-policies","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/premier-developer\/control-access-to-power-apps-and-power-automate-with-azure-ad-conditional-access-policies\/","title":{"rendered":"Control Access to Power Apps and Power Automate with Azure AD Conditional Access Policies"},"content":{"rendered":"

App Dev Manager Roger Lamb<\/a> and Dev Consultant Adam Toth<\/a> detail how to control access to Power Apps and Power Automate using Azure AD Conditional Access Policies.<\/p>\n

UPDATE 9\/9\/2022:<\/strong> Microsoft Product Support requested an update to this article to indicate that blocking only one of these products at a time could introduce various issues and is not supported.\u00a0 If you are going to use this policy to block Power Platform features, make sure you block both Power Automate and Power Apps at the same time. The reason is that some features of one application are dependencies for another, for example some Power Automate UI features require Power Apps functionality under the cover to work (Solutions, Dataverse, etc), and those UI operations may fail if you block Power Apps but try and use the Power Automate Portal.<\/p>\n

\n

Overview<\/h2>\n

As companies begin adoption of Microsoft 365 citizen developer platforms, such as Microsoft Power Apps and Power Automate (Flow), there is a growing demand to control access to these platforms. Governance and administration best-practices are paramount to ensuring only authorized users have access to critical systems. When combined with multiple organizations and users, varying levels of access, and the need for user-level permissions, maintaining Power Apps and Power Automate solutions may be a challenge.<\/p>\n

Each Microsoft 365 tenant has a default environment provisioned for use with PowerApps and Power Automate, where any licensed user can contribute Power Apps and Power Automate workflows immediately. There is currently no mechanism to restrict the Maker role (i.e. who can create Power Apps and Power Automate workflows) in the Default environment, so many companies look for the ability to limit access to these systems until a fully-featured governance and administration process is put in place, or until the platform has been vetted through pilot rollouts to limited numbers of users.<\/p>\n

Fortunately, this can easily be achieved using Microsoft Azure Active Directory (AD) Conditional Access Policies.<\/p>\n

About Conditional Access Policies<\/h2>\n

Conditional Access Policies in Azure AD are a flexible way for administrators to control access to Microsoft-based services for end users. The diagram below illustrates how to wire up Conditional Access policies to restrict access to end users for both PowerApps and Power Automate.<\/p>\n

Conditional Access policies at their simplest form are if-then statements: if a user wants to access a resource, then they must complete an action.<\/p>\n

<\/p>\n

Find out more about Conditional Access (CA) policies here<\/a>.<\/p>\n

Conditional Access Policies are available to tenants that subscribe to Azure AD Premium capabilities, including Azure AD Premium P1, P2, or Microsoft 365 Business license<\/a>.<\/p>\n

For more information on comparisons of Azure Active Directory P1 and P2 licenses as well as pricing please review the documentation here<\/a>.<\/p>\n

Create a Conditional Access Policy<\/h2>\n

To create a Conditional Access Policy, first access the Azure portal and navigate to the Azure Active Directory blade. Access this through portal.azure.com or from the Admin Center links in the Office365 Administration Center.<\/p>\n

<\/p>\n

Once in the Azure AD management blade, select Properties<\/strong>.<\/p>\n

<\/p>\n

On the Properties screen, select the Manage Security Defaults<\/strong> option at the bottom.<\/p>\n

<\/p>\n

<\/p>\n

Make sure that Enable Security defaults<\/strong> is off<\/strong> in order to use Conditional Access Policies.<\/p>\n

For more information about Security Defaults, see this link<\/a>.<\/p>\n

Once the defaults are turned off (they may already be off if Conditional Access has been used for other purposes, such as MFA and location-based access policies), the policy for accessing PowerApps and Power Automate (Flow) can be configured<\/p>\n

Return to the Azure Active Directory<\/strong> blade and select Security<\/strong>.<\/p>\n

<\/p>\n

In the next blade, select Conditional Access<\/strong>.<\/p>\n

<\/p>\n

In the next screen, click the New policy<\/strong> button to create a new policy:<\/p>\n

<\/p>\n

Name the new policy:<\/p>\n

<\/p>\n

To configure a new Conditional Access Policy, 1) Define who\/what the policy applies to, and 2) Define what actions to take for anything that matches Step 1.<\/p>\n

Step 1. Configure the users that this new policy applies to. Under Assignments<\/strong>, select Users and Groups<\/strong>.<\/p>\n

<\/p>\n

Select which users and groups to Include <\/strong>and Exclude <\/strong>from the new policy. In the following example, access to PowerApps and Flow is blocked for most users and is enabled only for Pilot <\/strong>users.<\/p>\n

Since the new policy is intended to block access to most users, for the Include <\/strong>setting, select All Users and Groups<\/strong>, and for the Exclude<\/strong> setting select any desired pilot users and any Power Platform services administrators that need to have access (and any break-glass accounts).<\/p>\n

IMPORTANT NOTE: <\/strong>Be careful here to avoid locking out administrator. Check out this guide for best practices on configuring CA policies<\/a>, and this guide for Block Access and exclusions<\/a>.\n<\/p>\n

Once the users have been configured, select the Cloud Apps<\/strong> that the new policy will apply to.<\/p>\n

<\/p>\n

Click Select apps<\/strong> and then the arrow to select. In the search bar on the following screen, look first for PowerApps<\/strong>, and check it to select it, then search for Microsoft Flow<\/strong>, and select it as well. Both items should show as selected.<\/p>\n

<\/p>\n

Click Select <\/strong>at the bottom of the screen. The two apps should now appear as part of the policy.<\/p>\n

<\/p>\n

Step 2. Once the users have been configured, the next step to create the new policies is to define what to do when the conditions are met. In this case, the purpose of the policy is to block access to these apps for most users but allow access for pilot users and admins.<\/p>\n

Select the Grant<\/strong> option under Access controls <\/strong>and click the arrow.<\/p>\n

<\/p>\n

In the Grant<\/strong> screen, select Block access<\/strong>.<\/p>\n

<\/p>\n

The policy is now configured and ready for deployment. To activate the policy, select On<\/strong> under Enable Policy<\/strong>.<\/p>\n

<\/p>\n

Once the new policy is on, if any users try and access PowerApps or Power Automate (Flow), they will receive the following message upon logging in:<\/p>\n

<\/p>\n

Summary<\/h2>\n

With just a few quick steps using the Azure AD Conditional Access Policy, it is easy to limit access to PowerApps and Power Automate. This quick fix allows time for companies to evaluate the platform, experiment with pilot users, and take the time to implement governance and administration best practices.<\/p>\n

Additional resources for Power Platform governance and administration topics:<\/p>\n